Skip to content

Update docs, changed formatting, fixed typo #38

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
OmegaLeWolf wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Update docs, changed formatting, fixed typo #38

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
26892b9
Update dcs8000lh.md
OmegaLeWolf May 13, 2024
7c63e08
Changed formatting
OmegaLeWolf May 13, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
50 changes: 43 additions & 7 deletions dcs8000lh.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -119,6 +119,7 @@ can do:

```
$ ./dcs8000lh-configure.py -h

usage: dcs8000lh-configure.py [-h] [--essid ESSID] [--wifipw WIFIPW]
[--survey] [--netconf] [--sysinfo]
[--command COMMAND] [--telnetd] [--lighttpd]
Expand Down Expand Up @@ -157,6 +158,7 @@ optional arguments:

```
$ ./dcs8000lh-configure.py B0:C5:54:AA:BB:CC 123456 --survey

Connecting to B0:C5:54:AA:BB:CC...
Verifying IPCam service
Connected to 'DCS-8000LH-BBCC'
Expand Down Expand Up @@ -185,6 +187,7 @@ Done.

```
$ ./dcs8000lh-configure.py B0:C5:54:AA:BB:CC 123456 --essid Kjellerbod --wifipw redacted

Connecting to B0:C5:54:AA:BB:CC...
Verifying IPCam service
Connected to 'DCS-8000LH-BBCC'
Expand All @@ -199,6 +202,7 @@ Done.

```
$ ./dcs8000lh-configure.py B0:C5:54:AA:BB:CC 123456 --netconf

Connecting to B0:C5:54:AA:BB:CC...
Verifying IPCam service
Connected to 'DCS-8000LH-BBCC'
Expand All @@ -221,6 +225,7 @@ complete backup of my camera.

```
$ ./dcs8000lh-configure.py B0:C5:54:AA:BB:CC 123456 --lighttpd

Connecting to B0:C5:54:AA:BB:CC...
Verifying IPCam service
Connected to 'DCS-8000LH-BBCC'
Expand Down Expand Up @@ -272,6 +277,7 @@ update image first.

```
$ curl --http1.0 -u admin:123456 --form upload=@fw.tar http://192.168.2.37/config/firmwareupgrade.cgi

upgrade=ok
```

Expand Down Expand Up @@ -310,6 +316,7 @@ stream sample:

```
$ curl --insecure -u admin:123456 https://192.168.2.37/video/mpegts.cgi>/tmp/stream

% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 93.1G 0 438k 0 0 92872 0 12d 11h 0:00:04 12d 11h 92853^C
Expand Down Expand Up @@ -372,6 +379,7 @@ first check the URL of the wanted profile using the NIPCA API:

```
$ curl -u admin:123456 --insecure 'https://192.168.2.37/config/rtspurl.cgi?profileid=1'

profileid=1
urlentry=live/profile.0
video_codec=H264
Expand Down Expand Up @@ -488,6 +496,7 @@ copying all camera flash partitions to a tftp server:

```
$ ./dcs8000lh-configure.py B0:C5:54:AA:BB:CC 123456 --telnetd

Connecting to B0:C5:54:AA:BB:CC...
Verifying IPCam service
Connected to 'DCS-8000LH-BBCC'
Expand All @@ -505,6 +514,7 @@ Done.


$ telnet 192.168.2.37

Trying 192.168.2.37...
Connected to 192.168.2.37.
Escape character is '^]'.
Expand Down Expand Up @@ -538,6 +548,7 @@ example, going back to v2.02.02:

```
$ curl --http1.0 -u admin:123456 --form upload=@DCS-8000LH_Ax_v2.02.02_3014.bin http://192.168.2.37/config/firmwareupgrade.cgi

curl: (52) Empty reply from server
```

Expand Down Expand Up @@ -624,6 +635,7 @@ and you'll get a `rlxboot#` prompt, with access to these U-Boot commands :

```
rlxboot# ?

? - alias for 'help'
base - print or set address offset
bootm - boot application image from memory
Expand Down Expand Up @@ -671,6 +683,7 @@ over serial, but I don't have the patience for that...
The environment is fixed and pretty clean:
```
rlxboot# printenv

=3
addmisc=setenv bootargs ${bootargs}console=ttyS0,${baudrate}panic=1
baudrate=57600
Expand Down Expand Up @@ -719,16 +732,19 @@ Then run the following commands:

`grep -Eq ^admin:x: /etc/passwd && echo "admin:$(pibinfo Pincode)" | chpasswd`

`tdb set HTTPServer Enable_byte=1"`
`tdb set HTTPServer Enable_byte="1"`

`tdb set HTTPAccount AdminPasswd_ss="$(pibinfo Pincode)"`

`/etc/rc.d/init.d/extra_lighttpd.sh start`

on the local machine, run

`$ curl --http1.0 -u admin:CAMPIN --form upload=@DCS-8000LH_Ax_v2.02.02_3014.bin http://CAM.IP/config/firmwareupgrade.cgi
curl: (52) Empty reply from server`
`$ curl --http1.0 -u admin:CAMPIN --form upload=@DCS-8000LH_Ax_v2.02.02_3014.bin http://CAM.IP/config/firmwareupgrade.cgi`

The camera should then reply with

`curl: (52) Empty reply from server`

this will downgrade the firmware to 2.02.02.

Expand Down Expand Up @@ -1188,6 +1204,7 @@ squasfs file system, with most of the mydlink cloud tools. The file
system can be unpacked on a Linux system using unsquashfs:
```
$ unsquashfs mtd2

Parallel unsquashfs: Using 4 processors
15 inodes (22 blocks) to write

Expand Down Expand Up @@ -1286,6 +1303,7 @@ slot of the DCS-8000LH...
A few of examples, using curl to read and set configuration variables:
```
$ curl -u admin:123456 http://192.168.2.37/common/info.cgi

model=DCS-8000LH
product=Wireless Internet Camera
brand=D-Link
Expand Down Expand Up @@ -1328,6 +1346,7 @@ starttime=3.2.0/02:00:00
stoptime=11.1.0/02:00:00

$ curl -u admin:123456 http://192.168.2.37/config/led.cgi?led=off

led=off
```

Expand Down Expand Up @@ -1371,6 +1390,7 @@ not in /lib. So we have to set LD\_LIBRARY\_PATH to run it manually:

```
# LD_LIBRARY_PATH=/var/bluetooth/lib sbin/gen_bt_config update_key_only

In main:182: modelStr = 'DCS-8000LH'
In main:183: mac = 'b0:c5:54:ab:cd:ef'
In update_ble_key:87: key data = 'DCS-8000LH-CDEF012345b2gaescrbldchnik'
Expand All @@ -1382,15 +1402,18 @@ is `012345`, and the dynamically generated challenge is
`/tmp/db/db.xml` and can be read directly from there:
```
# grep Key /tmp/db/db.xml |tail -2

<ChallengeKey type="3" content="b2gaescrbldchnik" />
<Key type="5" content="jrtY6nONQ5rV+2Ph" />
```

Or you can read them using the same tools the Bluetooth system uses:
```
# tdb get Ble ChallengeKey_ss

b2gaescrbldchnik
# mdb get ble_key

jrtY6nONQ5rV+2Ph
```

Expand All @@ -1400,13 +1423,15 @@ read the key using tdb too:

```
# tdb get Ble Key_ss

jrtY6nONQ5rV+2Ph
```

Generating the same key by hand on a Linux system is simple:

```
$ echo -n 'DCS-8000LH-CDEF012345b2gaescrbldchnik' | md5sum | xxd -r -p | base64 | cut -c-16

jrtY6nONQ5rV+2Ph
```

Expand Down Expand Up @@ -1471,11 +1496,13 @@ The **gattool** Linux command line tool is useful for exploring
Bluetooth LE devices. You can look for primary services and list
associated characteristics of a service:
```
[B0:C5:54:AA:BB:CC][LE]> primary
[B0:C5:54:AA:BB:CC][LE]> primary

attr handle: 0x0001, end grp handle: 0x0008 uuid: 00001800-0000-1000-8000-00805f9b34fb
attr handle: 0x0010, end grp handle: 0x0010 uuid: 00001801-0000-1000-8000-00805f9b34fb
attr handle: 0x0011, end grp handle: 0x002e uuid: 0000d001-0000-1000-8000-00805f9b34fb
[B0:C5:54:AA:BB:CC][LE]> characteristics 0x0011

handle: 0x0012, char properties: 0x12, char value handle: 0x0013, uuid: 0000a000-0000-1000-8000-00805f9b34fb
handle: 0x0015, char properties: 0x0a, char value handle: 0x0016, uuid: 0000a001-0000-1000-8000-00805f9b34fb
handle: 0x0017, char properties: 0x02, char value handle: 0x0018, uuid: 0000a100-0000-1000-8000-00805f9b34fb
Expand Down Expand Up @@ -1608,7 +1635,8 @@ and do not need to know what they mean.
FWIW, my example setting `M=0;I=Kjellerbod;S=4;E=2`
is mapped to this wpa_supplicant configuration:
```
# cat /tmp/wpa_supplicant.conf
# cat /tmp/wpa_supplicant.conf

ctrl_interface=/var/run/wpa_supplicant
device_type=4-0050F204-3
model_name=DCS-8000LH
Expand Down Expand Up @@ -1700,21 +1728,24 @@ Looking at the contents of a firmware update from D-Link can be
demotivating at the beginning:

```
$ tar xvf DCS-8000LH_Ax_v2.02.02_3014.bin
$ tar xvf DCS-8000LH_Ax_v2.02.02_3014.bin

update.bin.aes
update.aes
aes.key.rsa
certificate.info
sign.sha1.rsa

$ file *

aes.key.rsa: data
certificate.info: ASCII text
sign.sha1.rsa: data
update.aes: data
update.bin.aes: data

$ ls -l

total 10956
-rw-r--r-- 1 bjorn bjorn 128 Feb 14 10:58 aes.key.rsa
-rw-r--r-- 1 bjorn bjorn 130 Feb 14 10:58 certificate.info
Expand All @@ -1728,7 +1759,8 @@ encrypted. The only directly readable file is this one, and it
doesn't tell us much:

```
$ cat certificate.info
$ cat certificate.info

Publisher:DMdssdFW1
Supported Models:DCS-8000LH,DCS-8000LH
Firmware Version:1.0.0
Expand Down Expand Up @@ -1778,20 +1810,23 @@ openssl versions):
$ openssl rsautl -decrypt -in aes.key.rsa -inkey decrypt.key -out aes.key

$ openssl aes-128-cbc -v -md md5 -kfile aes.key -nosalt -d -in update.bin.aes -out update.bin

bufsize=8192
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
bytes read : 936464
bytes written: 936454

$ openssl aes-128-cbc -v -md md5 -kfile aes.key -nosalt -d -in update.aes -out update

bufsize=8192
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
bytes read : 10268368
bytes written: 10268355

$ file update.bin update

update.bin: POSIX shell script, ASCII text executable
update: data
```
Expand Down Expand Up @@ -1894,6 +1929,7 @@ Rebuilding the example is as easy as typing **make**. The Makefile is a
noisy one, so you can see all that's going on:
```
$ make

echo "WARNING: keys/DCS-8000LH-sign.pem is missing - using a new abitrary key instead"
WARNING: keys/DCS-8000LH-sign.pem is missing - using a new abitrary key instead
[ -f random-signkey.pem ] || openssl genrsa -out random-signkey.pem
Expand Down